PATENT 

REMARKS 

Claims 1, 2, 4-10, 12-17 and 19-30 are pending in the application. 
Claims 1, 2, 4-10, 12-17 and 19-30 have been rejected. 

Re jection o f Claims under 35 U.S,C. $103 

Claims 1, 2, 4-10, 12-17, and 19-30 stand rejected imder 35 U.S.C. § 103(a) as being 
unpatentable over U.S. Patent 6,570,875, issued to Hegde ("Hegde") in view of at least U.S. 
Patent 5,884,080, issued to Blandy ("Blandy"). AppHcants respectfully traverse these rejections. 

In order for a claim to be rendered invalid under 35 U.S.C. § 103(a), the subject matter of 
the claim as a whole would have to be obvious to a person of ordinary skill in the art at the time 
the invention was made. See 35 U.S.C. § 103(a). This requires: (1) the reference(s) must teach 
or suggest all of the claim limitations; (2) there must be some teaching, suggestion or motivation 
to combine references either in the references themselves or in the knowledge of the art; and (3) 
there must be a reasonable expectation of success. See MPEP 2143; MPEP 2143.03; In re 
Rouffet, 149 F.3d 1350, 1355-56 (Fed. Cir. 1998). The burden is on the Examiner to support a 
case of obviousness, including whether the prior art references teach or suggest all of the claim 
limitations. See MPEP 706.020). 

Independent Claims 1, 9, 16. and 23: 

Lidependent Claims 1, 9, 16, and 23 stand rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Hegde in view of Blandy. Applicants respectfully traverse these rejections. 

Each of the independent claims contains a limitations related to "determining whether to 

process the group of information for network traffic data collection." See, e.g., Claim 1. The 

Office Action cites to Hegde as disclosing this claim limitation. Applicants respectfully submit 
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that neither the cited sections of Hegde nor the additional references disclose this claim 
limitation. 

Hegde discloses a network router that analyzes packet source and destination information 
in order to update router tables. 

Incoming data packets are examined and the flow (i.e., soiu-ce and destination) 
with which they are associated is determined. A flow table contains forwarding 
information that can be applied to the flow. If an entry is not present in the table 
for the particular flow, the packet is forwarded to the CPU to be processed. The 
CPU can then update the table with new forwarding information to be applied to 
all future packets of the same flow. 

Hegde 2:65-3:6; see also, Hegde 10:36-44 (updating the flow table if the source of flow is 

unresolved); Hegde 1 1:65-12:5 (updating the flow table if the destination address is unresolved). 

Updating a router flow table, as disclosed in Hegde, is not network traffic data collection as 

claimed in the pending claims and disclosed in the present Application. 

The pending claims themselves distinguish between processing a group of information 
for network traffic data collection and processing to determine router flow. See, e.g.. Claim 4 
("sending the group of information to one or more processing engines to determine routing to the 
destination and forwarding the group of information according to the determined routing" if a 
destination is not already in the forwarding table). Applicants have found no disclosure within 
Hegde of network traffic data collection as claimed. Further, the Office Action does not suggest 
that Blandy provides any support for this claim limitation. 

All of the referenced independent claims contain a limitation for "determining whether to 

process the group of information for network traffic data collection, wherein said determining is 

performed according to sampling algorithm that is selected fi-om one of .. . selecting the group of 

information based on examination of traffic attribute data in the group of information." See, e.g.. 

Claim 1. The Office Action suggests that Hedge discloses the subject matter of this claim 
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limitation. However, the cited sections of Hegde do not relate to selecting a group of 
information based on an examination of traffic attribute data in that group of information. As an 
initial point, as stated above. Applicants respectfully submit that Hegde does not contain any 
disclosure related to determining whether to process a group of information for network traffic 
data collection. Since Hegde does not contain such disclosure, Hegde cannot perform such 
determining according to a sampling algorithm as described in the claim limitation. Further, the 
cited sections of Hegde are related to (a) a switch engine examining a header in preparation for 
forwarding a packet, not making a determination of whether to process a group of information 
for network traffic data collection, and (b) creating a flow table entry for an unresolved source of 
flow, which is distinct from determining whether to process a group of information for network 
traffic data collection, as stated above. 

The Office Action further suggests that Blandy contains disclosure for the above-stated 
claim limitation. Applicants respectfully submit that the sections of Blandy cited for such a 
proposition do not provide such disclosure. In addition. Applicants submit that Blandy presents 
no disclosure of manipulating network traffic data of any kind, including determining whether to 
process a group of information for network traffic data collection. As stated in Blandy's 
Summary of the Mvention section, Blandy "is directed to a system and method for monitoring 
system performance by sampling instructions in a burst mode, rather than once per interrupt." 
Blandy 2:64-66. The phrase "monitoring system performance" in Blandy refers to determining 
those software modules within a system that are most frequently executed and which lines of 
code within those software modules are most frequently executed. See Blandy 1:14-23. Blandy 
suggests that performing such analysis using burst data collection rather than an interrupt-driven 
method is less intrusive to the system being monitored for reasons such as conservation of data 
space, avoiding stopping the system during every interrupt (which adversely affects the system 
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performance), and avoiding giving a "ragged view of the performance data" due to random data 
point collection. 

Blandy does not provide any suggestion that this system performance monitoring method 
can be used to monitor network traffic data attributes or to perform network traffic data 
collection. Therefore, Blandy cannot be said to select a group of information based on an 
examination of traffic attribute data in the group of information in order to determine whether to 
process the group of inforaiation for network traffic data collection as claimed. The sections of 
Blandy cited by the Office Action relate to: (a) an external interrupt handler that activates a 
performance monitor if a system interrupt corresponds with a performance timer interrupt {see 
Blandy 5:29-6:25); (b) a single-step execution handler that decrements a burst counter and 
determines whether the burst counter has reached a zero point {see Blandy 6:26-58). These cited 
sections of Blandy do not relate to selecting a group of data based on information in that group of 
data, but instead relate to turning on and off a performance monitor based on timing criteria and 
expiration of a burst coimter. 

For at least the reasons discussed above, Applicants respectfiiUy submit that neither 
Hegde nor Blandy, alone or in combination, disclose the above-cited claim limitation. 

The independent claims listed above also contain a limitation of "determining whether to 
process the group of information for network traffic data collection, wherein said determining is 
performed according to a sampling algorithm that is selected firom one of... a burst sampling 
algorithm." See, e.g.. Claim 1. The Office Action admits that Hegde does not explicitly disclose 
such a limitation. See Office Action, p.3. The Office Action suggests that Blandy discloses this 
limitation by citing to Figures 2 and 3 of Blandy. Applicants respectfixlly submit that while 
Blandy purports to disclose burst mode monitoring of system performance for software, Blandy 
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does not disclose the above quoted limitation from the independent claims. Specifically, as 
stated above, Blandy does not teach sampling of network traffic data by any method. 
Consequently, Blandy does not teach determining whether to process a group of information for 
network traffic data collection according to a burst sampling algorithm. Rather, Blandy is 
limited to purportedly disclosing of burst monitoring performance of one or more processors 
running instructions of software. For at least these reasons. Applicants submit that neither Hegde 
nor Blandy, alone or in combination, discloses the above quoted claim limitation. 

Applicants fiirther submit that there is no teaching, suggestion or motivation to combine 
Hegde with Blandy either in the references or in the knowledge of the art. Hegde discloses a 
router that is designed to update routing tables upon a determination that a source or destination 
of a packet is not present in a flow table. In order to do this, Hegde must monitor every packet 
of information coming through the disclosed ports. See^ e.g., Hegde 5:38-43 ([SJwitch module 
60 continually monitors each of the ports for incoming traffic when a data packet arrives, it 
checks the packet header for information that identifies the flow to which the packet belongs.") 
(emphasis added). The disclosure in Hegde is clear that the Hegde router must operate in a mode 
where every packet is analyzed. Hegde performs routing on a packet, not based upon a sampling 
algorithm, but on whether a source/destination address combination is found in the flow table. If 
Hegde did not analyze at least the source and destination of each received packet, the Hegde 
router could not effectively update its flow tables. Thus, a person of ordinary skill in the art 
would not be motivated to combine the continuously monitoring Hegde router with a disclosure 
that suggests anything but continuous monitoring. 

As stated above, Blandy does not relate to network traffic data collection, but instead is 

directed toward system performance monitoring to determine which software modules are most 

frequently executed and which lines of code within those modules are most frequently executed, 
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Blandy contains no suggestion of monitoring network traffic data or that the burst sampling 
methods disclosed within Blandy could be applied to network traffic data collection. The Office 
Action's suggestion to use Blandy because "it would provide a performance system monitor 
system performance with minimal changes to the operating system and no changes to the 
application code", ignores the fact that the present application and claims do not relate to 
operating system performance but rather to network traffic data handling. Thus, a person of 
ordinary skill in the art would not be motivated to combine Hegde with Blandy. 

Applicants further respectfully submit that a person of ordinary skill in the art would not 
expect success from a combination of Blandy with Hegde. As an initial reason, if a Hegde router 
did not analyze at least the source and destination of each received packet, then the Hegde router 
could not effectively update its flow tables. Therefore, a combination of Hegde with any 
disclosure suggesting anything but analysis of every packet would not be expected to be 
successful. Secondly, Blandy itself does not suggest that its method can be used to sample 
network traffic data. Even if an assumption is made that the disclosed method within Blandy can 
be used for network traffic data, there is no indication within Hegde or Blandy that the use of 
Blandy' s interrupt driven system could function to sample network traffic data, nor does the 
Office Action present any rationale for the functionality of such an interrupt driven system in 
sampling network traffic data. Burst sampling as described in the present application relates to 
sampling a set number of packets {see, e.g., Application, p. 14, 1.16), while Blandy discloses 
setting a burst collection time period based on a number of interrupts {see Blandy 4:40-49). 
Thus, even were the Blandy method usable with Hegde, it would not perform the same burst 
sampling method disclosed and claimed in the present application. Finally, there is no indication 
within Hegde whether a Hegde router could function having any processor disclosed therein 
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operating under an interrupt driven sampling method such as that of Blandy. Therefore, a person 
of ordinary skill in the art would not expect success from combining Hegde with Blandy. 

For at least the above reasons, Applicants respectfully submit that the suggested 
combination of Hegde with Blandy does not present a prima facia case of obviousness for the 
independent claims, and all claims dependent thereon, and that therefore all these claims are in 
condition for allowance. Applicants therefore respectfully request the Examiner's 
reconsideration and withdrawal of the rejections to those claims. 



CONCLUSION 

In view of the amendments and remarks set forth herein, the application and the claims 
therein are believed to be in condition for allowance without any further examination and a 
notice to that effect is solicited. Nonetheless, should any issues remain that might be subject to 
resolution through a telephonic interview, the Examiner is invited to telephone the undersigned 
at 512-439-5090. 



I hereby certify that this correspondence is being deposited with 
the United States Postal Service as First Class Mail in an envelope 
addressed to: Mail Stop Amendment, COMMISSIONER FOR 
PATENTS, P. O. Box 1450, Alexandria, VA 22313-1450, on 
September 21, 2005. 
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